April Campaigns

Date,Details,Users Targeted
4/1/2019,"""Payment�Invoice�Slip(Swift�TT)""; zip -> formbook continued into 4/3",37
4/1/2019,"""Bosphorus Trading Request for Quotation.""; doc -> nanocore",2
4/1/2019,"""RE: RFQ 40000 DWT Tanker Building Project""; zip -> lokibot continued into 4/2",18
4/1/2019,"""Order""; rar -> lokibot",2
4/2/2019,All subjects contain DocuSign; link -> hancitor -> pony -> evilpony -> gozi-ursnif,1169
4/2/2019,"""Re :JANK  NEW ORDER Top Urgent""; xlsx -> agenttesla",2
4/3/2019,All subjects contain eFax; link -> hancitor -> pony -> evilpony -> gozi-ursnif,2664
4/4/2019,"""RFQ - New purchase Order 11207""; rar -> formbook",2
4/4/2019,"All subjects involve images; zip -> js -> gandcrab ransomware, phorpiex, coinminer, ursnif, dreambot continued into 4/5",523
4/8/2019,"""MAERSK - Complete Shipping instructions""; xlsx -> hawkeye keylogger",2
4/9/2019,All subjects contain DocuSign; link -> hancitor -> pony -> evilpony -> gozi-ursnif,466
4/9/2019,"""Order # 6491739""; jar -> adwind",3
4/10/2019,Sender address is promero@alpinefresh.com; doc -> trickbot,4
4/10/2019,All subjects contain Paypal; link -> hancitor -> pony -> evilpony -> gozi-ursnif,2053
4/10/2019,All subjects contain Japanese characters; xls -> ursnif,10
4/10/2019,REQUEST FOR QUOTATION; doc xlsx -> hawkeye ,2
4/10/2019,"""Additional purchase order- 40ft fcl Vietnam""; doc -> formbook",2
4/11/2019,"""Order 2169/HE -101114+MSDS""; xlsx -> hawkeye",2
4/12/2019,"""Approved order for 50MT/ 1X20ft FCL Vietnam shipment""; doc -> formbook",2
4/14/2019,"""Payment Advice from HSBC Bank"";doc -> formbook",2
4/14/2019,"""ORDER #049101""; docx -> hawkeye keylogger",2
4/14/2019,"""Fw: REQUEST FOR 40000 DWT BUILDING QUOTATION""; gz -> lokibot continued into 4/16",40
4/15/2019,Various subjects; link -> qrat,3
4/15/2019,All subjects contain eFax ; link -> hancitor -> pony -> evilpony -> gozi-ursnif,2085
4/16/2019,All subjects contain DocuSign; link -> hancitor -> pony -> evilpony -> gozi-ursnif,240
4/16/2019,"""URGENT QUOTATION"";iso -> pony",10
4/17/2019,"""New Doc""; xlsx -> hawkeye keylogger",2
4/17/2019,"""Purchase Order""; iso -> pony",9
4/18/2019,"""New Order""; xlsx -> hawkeye keylogger continued into 4/19",2
4/19/2019,"""APRIL ORDER-LIST / ASIANA IMPORT & EXPORT TRADING CO.,LTD (RFQ) ""; 2 rar -> formbook nanocore until 4/23",45
4/19/2019,"""Terratec�S.R.Ltd�Urgent�request�for�quotation.""; 2 rar -> formbook nanocore continued into 4/25",44
4/22/2019,"""Purchase Order""; xlsx -> hawkeye keylogger",2
4/22/2019,"""SHIPPING DOCS""; rar -> pony",11
4/23/2019,"""APPROVED ORDER CONFIRMATION- 1x20ft TAIWAN SHIPMENT""; doc -> formbook",2
4/23/2019,"""Fw:Re:Re: Report From Bank TT (Ref: 0060418)""; doc -> nanocore continued into 4/24",4
4/24/2019,"""Shipment for Pickup""; img -> nanocore continued into 4/25",13
4/24/2019,"""RFQ # 6200920003; BCD 05 APRIL2019""; doc -> hawkeye continued into 4/25",2
4/29/2019,Sender lumber@knightsnet.com various subjects; exe -> formbook,7
4/30/2019,"""Payment swift copy - Advice Ref:[B52713238407]""; xlsx -> formbook",2